Viirusten riivaama kone

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Naamikko, Jun 5, 2008.

Page 1 of 2
  1. Naamikko

    Naamikko Member

    Joined:
    Jun 5, 2008
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Muutama päivä sitten sain mesessä tuttavaltani viestin:
    "Onko toi sun kuva (joku linkki)"

    Klikkasin linkin ja se avasi selaimeen lataus sivun. Latasin sitten ajattelemattomuuttani tiedoston koneelleni, jota luulin kuvaksi, mutta se osoittautui samaiseksi viirukseksi jonka uhriksi olin äsken joutunut. Vähän aikaa se sitten lähetteli sitä viestiä mesessä kaikille jotka olivat online, kunnes luin että sen saa loppumaan vaihtamalla salasanan ja se auttoikin.

    Epäilen että koneellani on muitakin viiruksia, sillä aina välillä on auennut itsestään komentorivi nimeltä C:\setz.exe (olen aina sulkenut sen)
    ja avast valittaa vähän väliä haittaohjelmasta. Olen aina painanut "Move to chest" mutta se sanoo samasta asiasta vähän ajan päästä uudestaan.
    (Tällä hetkellä on kyllä ihmeen hiljaista?)

    Olen tässä kokeillut muutamia ohjelmia noiden viirusten kukistamiseksi, mutta mikään ei ole vielä riittänyt lannistamaan niitä kokonaan. Olen kokeillut mm. Spybot, Ad-Aware, avast antivirus, NoLop, CCleaner...


    Logfile of HijackThis v1.99.1
    Scan saved at 16:55:39, on 5.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\system32\nvsvc32.exe
    E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\PROGRA~1\AVG\AVG8\avgam.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\Explorer.EXE
    E:\Program Files\Gmail\Gmail Notifier\gnotify.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
    C:\Documents and Settings\KATTILA\Työpöytä\Pelit\Kalenteriohjelma\Rainlendar2\Rainlendar2.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SEC\MagicTune3.5_Client\GammaTray.exe
    E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    E:\Program Files\Logitech (päivitys)\SetPoint\SetPoint.exe
    C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Documents and Settings\KATTILA\Työpöytä\HijackThis_v1.99.1.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\1610D9~1.200\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] E:\Program Files\Gmail\Gmail Notifier\gnotify.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Windows svchost] service.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [MSN] C:\Windows\mservice.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [Rainlendar2] C:\Documents and Settings\KATTILA\Työpöytä\Pelit\Kalenteriohjelma\Rainlendar2\Rainlendar2.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Color Calibration.lnk = ?
    O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = ?
    O4 - Global Startup: MagicTune 3.5.lnk = ?
    O4 - Global Startup: NaturalColorLoad.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\1610D9~1.200\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\1610D9~1.200\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O20 - AppInit_DLLs: avgrsstx.dll
    O20 - Winlogon Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PD91Agent - Raxco Software, Inc. - E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe
    O23 - Service: PD91Engine - Raxco Software, Inc. - E:\Program Files\1.6.2008\Uusi kansio\PD91Engine.exe

    Kiitos jo etukäteen.
     
    Naamikko, Jun 5, 2008
    #1
  2. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Jun 5, 2008
    #2
  3. Naamikko

    Naamikko Member

    Joined:
    Jun 5, 2008
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    ComboFix 08-06-04.5 - KATTILA 2008-06-05 19:36:24.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.635 [GMT 3:00]
    Running from: C:\Documents and Settings\KATTILA\Työpöytä\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run -------
    .
    C:\bot.exe
    C:\d.exe
    C:\setup.exe
    C:\WINDOWS\Downloaded Program Files\setup.inf

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_NWSAPAGENT
    -------\Service_NwSapAgent


    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-05 to 2008-06-05 )))))))))))))))))
    .

    2008-06-05 15:41 . 2008-06-05 16:21 <KANSIO> d--h-c--- C:\$AVG8.VAULT$
    2008-06-05 15:22 . 2008-06-05 15:28 <KANSIO> d----c--- C:\WINDOWS\system32\drivers\Avg
    2008-06-05 15:22 . 2008-06-05 15:22 <KANSIO> d----c--- C:\Program Files\AVG
    2008-06-05 15:22 . 2008-06-05 15:22 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\avg8
    2008-06-05 15:22 . 2008-06-05 15:22 96,520 --a--c--- C:\WINDOWS\system32\drivers\avgldx86.sys
    2008-06-05 15:22 . 2008-06-05 15:22 75,272 --a--c--- C:\WINDOWS\system32\drivers\avgtdix.sys
    2008-06-05 15:22 . 2008-06-05 15:22 12,424 --a--c--- C:\WINDOWS\system32\drivers\avgrkx86.sys
    2008-06-05 15:22 . 2008-06-05 15:22 10,520 --a--c--- C:\WINDOWS\system32\avgrsstx.dll
    2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a--c--- C:\Documents and Settings\KATTILA\stp.exe
    2008-06-04 21:59 . 2008-06-04 22:06 86,528 --a--c--- C:\stp.exe
    2008-06-04 21:46 . 2008-06-04 21:46 60,128 --a--c--- C:\setupb.exe
    2008-06-04 14:37 . 2008-06-04 16:03 3,424 --a--c--- C:\Documents and Settings\Pasi\setup.exe
    2008-06-04 14:34 . 2008-06-04 21:47 3,424 --a--c--- C:\is155400.exe
    2008-06-03 21:57 . 2008-06-03 21:57 86,548 --a--c--- C:\f.bat
    2008-06-03 18:37 . 2008-06-03 21:23 86,548 --a--c--- C:\Documents and Settings\KATTILA\setupa.exe
    2008-06-03 18:32 . 2008-06-04 08:53 3,423 --a--c--- C:\setz.exe
    2008-06-03 18:09 . 2008-06-03 22:10 86,548 --a--c--- C:\ssetup.exe
    2008-06-03 15:24 . 2008-06-03 18:18 96,950 --a--c--- C:\Documents and Settings\KATTILA\setup.exe
    2008-06-02 22:32 . 2008-06-04 08:12 3,415 --a--c--- C:\WINDOWS\is154890.exe
    2008-06-02 19:58 . 2008-06-02 22:42 121 --a--c--- C:\WINDOWS\bdagent.INI
    2008-06-02 19:49 . 2008-06-02 22:44 <KANSIO> d----c--- C:\Program Files\BitDefender
    2008-06-02 19:47 . 2008-06-02 19:49 <KANSIO> d----c--- C:\Program Files\Common Files\BitDefender
    2008-06-02 19:16 . 2008-06-02 19:16 <KANSIO> d----c--- C:\Program Files\Java
    2008-06-02 19:16 . 2008-06-02 19:16 <KANSIO> d----c--- C:\Program Files\Common Files\Java
    2008-06-02 19:16 . 2008-03-25 02:37 69,632 --a--c--- C:\WINDOWS\system32\javacpl.cpl
    2008-06-02 19:04 . 2008-06-02 19:04 2 --a--c--- C:\-593823326
    2008-06-02 19:03 . 2008-06-02 19:04 6,144 --a--c--- C:\abhwevhi.exe
    2008-06-02 19:02 . 2008-06-02 19:03 4,096 --a--c--- C:\uucn.exe
    2008-06-02 19:00 . 2008-06-02 19:02 12,288 --a--c--- C:\vieiiy.exe
    2008-06-02 18:58 . 2008-06-02 19:00 9,216 --a--c--- C:\hldtlwe.exe
    2008-06-02 17:36 . 2008-06-03 18:18 60,114 --a--c--- C:\bot1.exe
    2008-06-01 22:26 . 2008-06-01 22:26 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Raxco
    2008-06-01 22:26 . 2008-01-09 22:00 68,624 -ra--c--- C:\WINDOWS\system32\drivers\DefragFS.sys
    2008-06-01 22:24 . 2008-06-02 19:20 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-06-01 21:46 . 2008-06-05 17:31 424 --a--c--- C:\delete.bat
    2008-06-01 19:46 . 2008-06-01 20:46 86,502 --a--c--- C:\sexy.com
    2008-06-01 16:46 . 2008-06-01 16:46 86,512 --a--c--- C:\irc.com
    2008-05-30 19:57 . 1998-08-10 22:21 132,096 --a--c--- C:\WINDOWS\system32\eaexec.exe
    2008-05-30 19:57 . 1998-08-10 22:20 24,576 --a--c--- C:\WINDOWS\system32\ealtest.exe
    2008-05-25 17:59 . 2008-05-25 17:59 <KANSIO> d----c--- C:\Program Files\Uusi kansio
    2008-05-23 18:11 . 2008-05-27 15:16 54,156 --ah-c--- C:\WINDOWS\QTFont.qfn
    2008-05-23 18:11 . 2008-05-23 18:11 1,409 --a--c--- C:\WINDOWS\QTFont.for
    2008-05-17 10:53 . 2008-05-19 17:02 <KANSIO> d----c--- C:\WINDOWS\system32\Adobe

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-05 12:14 --------- dc----w C:\Documents and Settings\KATTILA\Application Data\LimeWire
    2008-06-04 19:02 --------- dc----w C:\Program Files\Paint.NET
    2008-05-23 11:07 --------- dc----w C:\Program Files\Windows Live Safety Center
    2008-05-20 12:14 --------- dc----w C:\Program Files\Microsoft Silverlight
    2008-05-01 17:42 --------- dc----w C:\Documents and Settings\All Users\Application Data\NPF
    2008-05-01 11:27 --------- dc----w C:\Program Files\Alwil Software
    2008-04-25 18:18 --------- dc-h--w C:\Program Files\InstallShield Installation Information
    2008-04-05 20:19 --------- dc----w C:\Program Files\Opera
    2008-04-05 07:50 --------- dc----w C:\Documents and Settings\KATTILA\Application Data\Winamp
    2008-03-25 04:51 621,344 -c--a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 -c--a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 -c--a-w C:\WINDOWS\system32\win32k.sys
    1999-06-30 13:06 151,552 -c--a-r C:\WINDOWS\inf\Agfa\Message.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Rainlendar2"="C:\Documents and Settings\KATTILA\Työpöytä\Pelit\Kalenteriohjelma\Rainlendar2\Rainlendar2.exe" [2007-07-24 10:12 1298432]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-03-29 22:48 86016]
    "RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 18:44 65536]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe]
    "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="E:\Program Files\Gmail\Gmail Notifier\gnotify.exe" [2005-07-16 00:48 479232]
    "Windows svchost"="service.exe" []
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-03-29 22:48 5898240]
    "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-05 15:22 1177368]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]

    C:\Documents and Settings\All Users\K&#8222;ynnist&#8222;-valikko\Ohjelmat\K&#8222;ynnistys\
    Color Calibration.lnk - C:\Program Files\SEC\MagicTune3.5_Client\GammaTray.exe [2006-12-22 15:36:58 36864]
    Logitech Desktop Messenger.lnk - E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-10 16:21:30 67128]
    Logitech SetPoint.lnk - E:\Program Files\Logitech (p&#8222;ivitys)\SetPoint\SetPoint.exe [2007-02-26 11:21:25 784912]
    MagicTune 3.5.lnk - C:\Program Files\SEC\MagicTune3.5_Client\MagicTuneTray.exe [2006-12-22 15:37:06 45056]
    NaturalColorLoad.lnk - C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe [2006-07-21 16:23:18 155715]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    c:\program files\common files\logitech\bluetooth\LBTWlgn.dll 2007-11-15 11:10 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.ffds"= E:\PROGRA~1\MEDIAP~1\CCCP\COMBIN~1\Filters\FFDShow\ff_vfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "E:\\Program Files\\EA GAMES\\Battlefield 2\\Support\\EasyInfo.exe"=
    "E:\\Program Files\\EA GAMES\\Battlefield 2\\Support\\EReg.exe"=
    "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "E:\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "E:\\Program Files\\EA games\\Battlefield 2\\BF2.exe"=
    "E:\\Program Files\\EA games\\Game Spy\\Aphex.exe"=
    "E:\\Program Files\\Age of Empires\\EMPIRES2.ICD"=
    "E:\\Program Files\\mIRC\\mirc.exe"=
    "E:\\Program Files\\EA games\\Medal of Honor\\mohpa.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "E:\\Program Files\\LimeWire\\LimeWire.exe"=
    "E:\\Program Files\\Empire Earth\\Empire Earth.exe"=
    "E:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\Opera\\Opera.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 0 (0x0)

    R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-06-05 15:22]
    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-05 15:22]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-05 15:22]
    R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-05 15:22]
    R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-05 15:22]
    R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-06-30 01:53]
    R2 PD91Agent;PD91Agent;"E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe" [2008-01-16 10:52]
    R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\getnd5b.sys [2004-01-29 09:32]
    S3 PD91Engine;PD91Engine;"E:\Program Files\1.6.2008\Uusi kansio\PD91Engine.exe" [2008-01-16 10:52]

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-06-05 16:10:44 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-05 19:37:32
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-05 19:38:12
    ComboFix-quarantined-files.txt 2008-06-05 16:38:07

    Pre-Run: 4,185,866,240 tavua vapaana
    Post-Run: 4,168,769,536 tavua vapaana

    175 --- E O F --- 2008-05-28 11:32:16
     
    Naamikko, Jun 5, 2008
    #3
  4. Hujo

    Hujo Guest

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

     
    Hujo, Jun 5, 2008
    #4
  5. Naamikko

    Naamikko Member

    Joined:
    Jun 5, 2008
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    ComboFix 08-06-04.5 - KATTILA 2008-06-05 20:37:21.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.633 [GMT 3:00]
    Running from: C:\Documents and Settings\KATTILA\Työpöytä\ComboFix.exe
    Command switches used :: C:\Documents and Settings\KATTILA\Työpöytä\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\-593823326
    C:\abhwevhi.exe
    C:\bot1.exe
    C:\hldtlwe.exe
    C:\irc.com
    C:\sexy.com
    C:\uucn.exe
    C:\vieiiy.exe
    C:\WINDOWS\mservice.exe
    C:\WINDOWS\service.exe
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\-593823326
    C:\abhwevhi.exe
    C:\bot1.exe
    C:\hldtlwe.exe
    C:\irc.com
    C:\sexy.com
    C:\uucn.exe
    C:\vieiiy.exe

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-05 to 2008-06-05 )))))))))))))))))
    .

    2008-06-05 15:41 . 2008-06-05 16:21 <KANSIO> d--h-c--- C:\$AVG8.VAULT$
    2008-06-05 15:22 . 2008-06-05 15:28 <KANSIO> d----c--- C:\WINDOWS\system32\drivers\Avg
    2008-06-05 15:22 . 2008-06-05 15:22 <KANSIO> d----c--- C:\Program Files\AVG
    2008-06-05 15:22 . 2008-06-05 15:22 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\avg8
    2008-06-05 15:22 . 2008-06-05 15:22 96,520 --a--c--- C:\WINDOWS\system32\drivers\avgldx86.sys
    2008-06-05 15:22 . 2008-06-05 15:22 75,272 --a--c--- C:\WINDOWS\system32\drivers\avgtdix.sys
    2008-06-05 15:22 . 2008-06-05 15:22 12,424 --a--c--- C:\WINDOWS\system32\drivers\avgrkx86.sys
    2008-06-05 15:22 . 2008-06-05 15:22 10,520 --a--c--- C:\WINDOWS\system32\avgrsstx.dll
    2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a--c--- C:\Documents and Settings\KATTILA\stp.exe
    2008-06-04 21:59 . 2008-06-04 22:06 86,528 --a--c--- C:\stp.exe
    2008-06-04 21:46 . 2008-06-04 21:46 60,128 --a--c--- C:\setupb.exe
    2008-06-04 14:37 . 2008-06-04 16:03 3,424 --a--c--- C:\Documents and Settings\Pasi\setup.exe
    2008-06-04 14:34 . 2008-06-04 21:47 3,424 --a--c--- C:\is155400.exe
    2008-06-03 21:57 . 2008-06-03 21:57 86,548 --a--c--- C:\f.bat
    2008-06-03 18:37 . 2008-06-03 21:23 86,548 --a--c--- C:\Documents and Settings\KATTILA\setupa.exe
    2008-06-03 18:32 . 2008-06-04 08:53 3,423 --a--c--- C:\setz.exe
    2008-06-03 18:09 . 2008-06-03 22:10 86,548 --a--c--- C:\ssetup.exe
    2008-06-03 15:24 . 2008-06-03 18:18 96,950 --a--c--- C:\Documents and Settings\KATTILA\setup.exe
    2008-06-02 22:32 . 2008-06-04 08:12 3,415 --a--c--- C:\WINDOWS\is154890.exe
    2008-06-02 19:58 . 2008-06-02 22:42 121 --a--c--- C:\WINDOWS\bdagent.INI
    2008-06-02 19:49 . 2008-06-02 22:44 <KANSIO> d----c--- C:\Program Files\BitDefender
    2008-06-02 19:47 . 2008-06-02 19:49 <KANSIO> d----c--- C:\Program Files\Common Files\BitDefender
    2008-06-02 19:16 . 2008-06-02 19:16 <KANSIO> d----c--- C:\Program Files\Java
    2008-06-02 19:16 . 2008-06-02 19:16 <KANSIO> d----c--- C:\Program Files\Common Files\Java
    2008-06-02 19:16 . 2008-03-25 02:37 69,632 --a--c--- C:\WINDOWS\system32\javacpl.cpl
    2008-06-01 22:26 . 2008-06-01 22:26 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Raxco
    2008-06-01 22:26 . 2008-01-09 22:00 68,624 -ra--c--- C:\WINDOWS\system32\drivers\DefragFS.sys
    2008-06-01 22:24 . 2008-06-02 19:20 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-06-01 21:46 . 2008-06-05 17:31 424 --a--c--- C:\delete.bat
    2008-05-30 19:57 . 1998-08-10 22:21 132,096 --a--c--- C:\WINDOWS\system32\eaexec.exe
    2008-05-30 19:57 . 1998-08-10 22:20 24,576 --a--c--- C:\WINDOWS\system32\ealtest.exe
    2008-05-25 17:59 . 2008-05-25 17:59 <KANSIO> d----c--- C:\Program Files\Uusi kansio
    2008-05-23 18:11 . 2008-05-27 15:16 54,156 --ah-c--- C:\WINDOWS\QTFont.qfn
    2008-05-23 18:11 . 2008-05-23 18:11 1,409 --a--c--- C:\WINDOWS\QTFont.for
    2008-05-17 10:53 . 2008-05-19 17:02 <KANSIO> d----c--- C:\WINDOWS\system32\Adobe

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-05 12:14 --------- dc----w C:\Documents and Settings\KATTILA\Application Data\LimeWire
    2008-06-04 19:02 --------- dc----w C:\Program Files\Paint.NET
    2008-05-23 11:07 --------- dc----w C:\Program Files\Windows Live Safety Center
    2008-05-20 12:14 --------- dc----w C:\Program Files\Microsoft Silverlight
    2008-05-01 17:42 --------- dc----w C:\Documents and Settings\All Users\Application Data\NPF
    2008-05-01 11:27 --------- dc----w C:\Program Files\Alwil Software
    2008-04-25 18:18 --------- dc-h--w C:\Program Files\InstallShield Installation Information
    2008-04-05 20:19 --------- dc----w C:\Program Files\Opera
    2008-04-05 07:50 --------- dc----w C:\Documents and Settings\KATTILA\Application Data\Winamp
    2008-03-25 04:51 621,344 -c--a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 -c--a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 -c--a-w C:\WINDOWS\system32\win32k.sys
    1999-06-30 13:06 151,552 -c--a-r C:\WINDOWS\inf\Agfa\Message.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Rainlendar2"="C:\Documents and Settings\KATTILA\Työpöytä\Pelit\Kalenteriohjelma\Rainlendar2\Rainlendar2.exe" [2007-07-24 10:12 1298432]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-03-29 22:48 86016]
    "RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 18:44 65536]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe]
    "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="E:\Program Files\Gmail\Gmail Notifier\gnotify.exe" [2005-07-16 00:48 479232]
    "Windows svchost"="service.exe" []
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-03-29 22:48 5898240]
    "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-05 15:22 1177368]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]

    C:\Documents and Settings\All Users\K&#8222;ynnist&#8222;-valikko\Ohjelmat\K&#8222;ynnistys\
    Color Calibration.lnk - C:\Program Files\SEC\MagicTune3.5_Client\GammaTray.exe [2006-12-22 15:36:58 36864]
    Logitech Desktop Messenger.lnk - E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-10 16:21:30 67128]
    Logitech SetPoint.lnk - E:\Program Files\Logitech (p&#8222;ivitys)\SetPoint\SetPoint.exe [2007-02-26 11:21:25 784912]
    MagicTune 3.5.lnk - C:\Program Files\SEC\MagicTune3.5_Client\MagicTuneTray.exe [2006-12-22 15:37:06 45056]
    NaturalColorLoad.lnk - C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe [2006-07-21 16:23:18 155715]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    c:\program files\common files\logitech\bluetooth\LBTWlgn.dll 2007-11-15 11:10 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.ffds"= E:\PROGRA~1\MEDIAP~1\CCCP\COMBIN~1\Filters\FFDShow\ff_vfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "E:\\Program Files\\EA GAMES\\Battlefield 2\\Support\\EasyInfo.exe"=
    "E:\\Program Files\\EA GAMES\\Battlefield 2\\Support\\EReg.exe"=
    "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "E:\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "E:\\Program Files\\EA games\\Battlefield 2\\BF2.exe"=
    "E:\\Program Files\\EA games\\Game Spy\\Aphex.exe"=
    "E:\\Program Files\\Age of Empires\\EMPIRES2.ICD"=
    "E:\\Program Files\\mIRC\\mirc.exe"=
    "E:\\Program Files\\EA games\\Medal of Honor\\mohpa.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "E:\\Program Files\\LimeWire\\LimeWire.exe"=
    "E:\\Program Files\\Empire Earth\\Empire Earth.exe"=
    "E:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\Opera\\Opera.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 0 (0x0)

    R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-06-05 15:22]
    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-05 15:22]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-05 15:22]
    R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-05 15:22]
    R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-05 15:22]
    R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-06-30 01:53]
    R2 PD91Agent;PD91Agent;"E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe" [2008-01-16 10:52]
    R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\getnd5b.sys [2004-01-29 09:32]
    S3 PD91Engine;PD91Engine;"E:\Program Files\1.6.2008\Uusi kansio\PD91Engine.exe" [2008-01-16 10:52]

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-06-05 17:10:04 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-05 20:38:15
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-05 20:38:49
    ComboFix-quarantined-files.txt 2008-06-05 17:38:46
    ComboFix2.txt 2008-06-05 16:38:14

    Pre-Run: 4,088,868,864 tavua vapaana
    Post-Run: 4,073,668,608 tavua vapaana

    178 --- E O F --- 2008-05-28 11:32:16
     
    Naamikko, Jun 5, 2008
    #5
  6. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, Jun 5, 2008
    #6
  7. Naamikko

    Naamikko Member

    Joined:
    Jun 5, 2008
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Malwarebytes' Anti-Malware 1.14
    Tietokantaversio: 829

    22:52:56 5.6.2008
    mbam-log-6-5-2008 (22-52-56).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|E:\|F:\|)
    Tarkistetut kohteet: 204846
    Kulunut aika: 1 hour(s), 23 minute(s), 37 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 28
    Saastuneita rekisteriarvoja: 1
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 13
    Saastuneita tiedostoja: 158

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CLASSES_ROOT\CLSID\{e282c728-189d-419e-8ee2-1601f4b39ba5} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{168dc258-1455-4e61-8590-9dac2f27b675} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{1a8642f1-dc80-4edc-a39d-0fb62a58b455} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{3f91eb90-ef62-44ee-a685-fac29af111cd} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{5c29c7e4-5321-4cad-be2e-877666bed5df} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{83dfb6ee-ab18-41b5-86d4-b544a141d67e} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{88d6cf0e-cf70-4c24-bf6e-e4e414bc649c} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{8f6a82a2-d7b1-443e-bb9f-f7dc887dd618} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{9856e2d8-ffb2-4fe5-8cad-d5ad6a35a804} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a3d06987-c35e-49e4-8fe2-ac67b9fbfb4c} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a58c497b-3ee2-45e7-9594-daca6be2a0d0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ad0a3058-fd49-4f98-a514-fd055201835e} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ad5915ea-b61a-4dba-b5c8-ef4b2df0a3c7} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{bb187c0d-6f53-4f3e-9590-98fd3a7364a2} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{c5041fd9-4819-4dc4-b20e-c950b5b03d2a} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{d17726cc-d4dd-4c4a-9671-471d56e413b5} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{db8cce99-59c6-4552-8bfc-058feb38d6ce} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{dc3a04ee-cdd7-4407-915c-a5502f97eecd} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{e1a63484-a022-4d42-830a-fbd411514440} (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\videoegg.activexloader (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\videoegg.activexloader.1 (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\videoegg (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videoegg.com/Publisher,version=1.5 (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\MozillaPlugins\@videoegg.com/Publisher,version=1.5 (Adware.VideoEgg) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows svchost (Backdoor.Bot) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Data (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Loader (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Updater (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Loader\4665 (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520 (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4665 (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\messages (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Updater\4665 (Adware.VideoEgg) -> Quarantined and deleted successfully.

    Saastuneita tiedostoja:
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Loader\4665\npvideoegg-loader.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Updater\updater.exe (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Updater\VideoEggBroker.exe (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Updater\VideoEggBroker.exe.old (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\bot1.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\irc.com.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\DataLOCKED (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Uninstall.exe (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Data\report.log (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Loader\loader.ver (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\publisher.ver (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\avcodec.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\crashRpt.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\FLVEncoder.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\lame_enc.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\LevelMeter.ax (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\libcurlve.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\libpng.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\npvideoegg-publisher.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\VideoEgg_FLVWriter.ax (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\zlib.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\aol_watermark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\audio_combo.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\audio_source.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\big_gray_logo.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\big_logo_cropped.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\blank_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\button_browse_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\button_browse_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\button_browse_up.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\camcorders_title.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\camcorder_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\camcorder_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\corners_bottom_left.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\corners_bottom_left_curve.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\corners_bottom_right.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\corners_top_right.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\done.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\done_capture.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\done_capture_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\done_capture_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\done_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\done_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dropshadow_bottom_left.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dropshadow_horiz.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dropshadow_vertical.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dropzone.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dv_fast_forward.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dv_pause.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dv_play.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dv_rewind.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dv_stop.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\email_instructions.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\email_sent.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\email_sent_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\email_sent_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\eraser.CUR (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\eraser_cursor.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\file_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\file_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\help.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_camcorder.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_camcorders.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_camcorder_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_camcorder_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_ff.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_file_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_file_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_pause.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_phone_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_phone_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_play.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_rewind.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_stop.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_webcam.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_webcams.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_webcam_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_webcam_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\loading.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\loading_movie.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\locating.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\logo.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\logo_bottom.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\logo_middle.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\logo_top.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\mobile_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\mobile_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\mobile_slide_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\movie_placeholder.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\ok.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\ok_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\ok_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_fast_forward.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_fast_forward_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_fill.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_pause.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_play.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_rewind.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_rewind_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_rewind_to_start.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\playhead.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\powered_by.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\progress.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\refresh_list_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\refresh_list_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\refresh_list_up.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\restart.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\restart_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_capture.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_capture_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_capture_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_capture_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_over_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_slider.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\stop_capture.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\stop_capture_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\stop_capture_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\stop_capture_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\stop_slider.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\tab_slide_deselected.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\tape_control.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_camcorder.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_camcorder_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_file.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_file_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_phone.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_phone_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_webcam.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_webcam_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\title.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\upload.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\uploading.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\uploading_fill.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\uploading_high.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\uploading_low.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\uploading_medium.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\uploading_thumbnail.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\upload_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\upload_from.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\upload_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_gray.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_green.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_high.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_low.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_orange.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_red.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_slider.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\waiting_for_email.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\webcams_title.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\webcam_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\webcam_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\messages\messages.en-US.bundle (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Updater\updater.ver (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Updater\4665\libcurlve.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\Application Data\VideoEgg\Updater\4665\updater.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Pasi\setup.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\KATTILA\setup.exe (Trojan.Agent) -> Quarantined and deleted successfully.
     
    Naamikko, Jun 6, 2008
    #7
  8. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, Jun 6, 2008
    #8
  9. Naamikko

    Naamikko Member

    Joined:
    Jun 5, 2008
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of HijackThis v1.99.1
    Scan saved at 17:58:35, on 6.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\system32\nvsvc32.exe
    E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe
    C:\PROGRA~1\AVG\AVG8\avgam.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\system32\ctfmon.exe
    E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    E:\Program Files\Logitech (päivitys)\SetPoint\SetPoint.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Documents and Settings\KATTILA\Työpöytä\HijackThis_v1.99.1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\1610D9~1.200\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] E:\Program Files\Gmail\Gmail Notifier\gnotify.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [Rainlendar2] C:\Documents and Settings\KATTILA\Työpöytä\Pelit\Kalenteriohjelma\Rainlendar2\Rainlendar2.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Color Calibration.lnk = ?
    O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = ?
    O4 - Global Startup: MagicTune 3.5.lnk = ?
    O4 - Global Startup: NaturalColorLoad.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\1610D9~1.200\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\1610D9~1.200\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O20 - AppInit_DLLs: avgrsstx.dll
    O20 - Winlogon Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PD91Agent - Raxco Software, Inc. - E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe
    O23 - Service: PD91Engine - Raxco Software, Inc. - E:\Program Files\1.6.2008\Uusi kansio\PD91Engine.exe
     
    Naamikko, Jun 6, 2008
    #9
  10. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O4 - HKCU\..\Run: [Rainlendar2] C:\Documents and Settings\KATTILA\Työpöytä\Pelit\Kalenteriohjelma\Rainlendar2\Rainlendar2.exe


    ===============

    koneella avast ja avg8 poista toinen

    ===============

    Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
    Linkki1
    Linkki2
    Linkki3

    1.Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
    2.Tuplaklikkaa NoLop.exe ajaaksesi sen
    3.Klikkaa nappulaa "Search and Destroy"
    <<Tietokoneesi skannataan saastuneiden tiedostojen osalta>>
    4, Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
    5. Klikkaa "REBOOT"-painiketta.
    6. NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
    -- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.
     
    Last edited by a moderator: Jun 6, 2008
    Hujo, Jun 6, 2008
    #10
  11. Naamikko

    Naamikko Member

    Joined:
    Jun 5, 2008
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Käskit merkkaamaan:
    "O4 - HKCU\..\Run: [Rainlendar2] C:\Documents and Settings\KATTILA\Työpöytä\Pelit\Kalenteriohjelma\Rainlendar2\Rainlendar2.exe"
    Nyt sitten lähti reilander kalenteriohjelmasta kaikki tallentamani tapahtumat. No äkkiäkös minä ne takaisin laitan.

    NoLop ei löytänyt mitään


    Logfile of HijackThis v1.99.1
    Scan saved at 22:59:54, on 6.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\system32\nvsvc32.exe
    E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\Explorer.EXE
    E:\Program Files\Gmail\Gmail Notifier\gnotify.exe
    C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
    C:\Program Files\SEC\MagicTune3.5_Client\GammaTray.exe
    E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    E:\Program Files\Logitech (päivitys)\SetPoint\SetPoint.exe
    C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\Rainlendar\Rainlendar.exe
    C:\Documents and Settings\KATTILA\Työpöytä\HijackThis_v1.99.1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\1610D9~1.200\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] E:\Program Files\Gmail\Gmail Notifier\gnotify.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Color Calibration.lnk = ?
    O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = ?
    O4 - Global Startup: MagicTune 3.5.lnk = ?
    O4 - Global Startup: NaturalColorLoad.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\1610D9~1.200\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\1610D9~1.200\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PD91Agent - Raxco Software, Inc. - E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe
    O23 - Service: PD91Engine - Raxco Software, Inc. - E:\Program Files\1.6.2008\Uusi kansio\PD91Engine.exe
     
    Last edited: Jun 6, 2008
    Naamikko, Jun 6, 2008
    #11
  12. Hujo

    Hujo Guest

    Yritä piilottaa ne paremmin että ei näy hjt:n lokissa.
    tuommon rivi poistetaan käynnistyvistä.

    ========

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)


    Poista vikasiedossa kansio

    C:\Program Files\AVG

    ================

    Lataa: RegSeeker.zip työpöydälle:

    Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman.
    Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen.
    Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri
    Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken).
    Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta
    klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin.
    Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet
    Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK".
    Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK".
    Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.

    ==============

    jyräytäs combofix loki uusi
     
    Hujo, Jun 6, 2008
    #12
  13. Naamikko

    Naamikko Member

    Joined:
    Jun 5, 2008
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    ComboFix 08-06-04.5 - KATTILA 2008-06-07 10:03:50.4 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.358.1035.18.687 [GMT 3:00]
    Running from: C:\Documents and Settings\KATTILA\Työpöytä\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-07 to 2008-06-07 )))))))))))))))))
    .

    2008-06-07 09:31 . 2008-06-07 09:32 <KANSIO> d----c--- C:\Documents and Settings\Järjestelmänvalvoja
    2008-06-07 09:07 . 2008-06-07 09:07 <KANSIO> d----c--- C:\RegSeeker
    2008-06-06 18:05 . 2008-06-06 18:05 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Avg8
    2008-06-05 21:20 . 2008-06-05 21:20 <KANSIO> d----c--- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-05 21:20 . 2008-06-05 21:20 <KANSIO> d----c--- C:\Documents and Settings\KATTILA\Application Data\Malwarebytes
    2008-06-05 21:20 . 2008-06-05 21:20 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-05 21:20 . 2008-05-30 01:06 34,296 --a--c--- C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-05 21:20 . 2008-05-30 01:06 15,864 --a--c--- C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-04 14:34 . 2008-06-04 21:47 3,424 --a--c--- C:\is155400.exe
    2008-06-03 18:32 . 2008-06-04 08:53 3,423 --a--c--- C:\setz.exe
    2008-06-02 22:32 . 2008-06-04 08:12 3,415 --a--c--- C:\WINDOWS\is154890.exe
    2008-06-02 19:58 . 2008-06-02 22:42 121 --a--c--- C:\WINDOWS\bdagent.INI
    2008-06-02 19:49 . 2008-06-02 22:44 <KANSIO> d----c--- C:\Program Files\BitDefender
    2008-06-02 19:47 . 2008-06-02 19:49 <KANSIO> d----c--- C:\Program Files\Common Files\BitDefender
    2008-06-02 19:16 . 2008-06-02 19:16 <KANSIO> d----c--- C:\Program Files\Java
    2008-06-02 19:16 . 2008-06-02 19:16 <KANSIO> d----c--- C:\Program Files\Common Files\Java
    2008-06-02 19:16 . 2008-03-25 02:37 69,632 --a--c--- C:\WINDOWS\system32\javacpl.cpl
    2008-06-01 22:26 . 2008-06-01 22:26 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Raxco
    2008-06-01 22:26 . 2008-01-09 22:00 68,624 -ra--c--- C:\WINDOWS\system32\drivers\DefragFS.sys
    2008-06-01 22:24 . 2008-06-02 19:20 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-06-01 21:46 . 2008-06-06 23:13 742 --a--c--- C:\delete.bat
    2008-05-30 19:57 . 1998-08-10 22:21 132,096 --a--c--- C:\WINDOWS\system32\eaexec.exe
    2008-05-30 19:57 . 1998-08-10 22:20 24,576 --a--c--- C:\WINDOWS\system32\ealtest.exe
    2008-05-25 17:59 . 2008-05-25 17:59 <KANSIO> d----c--- C:\Program Files\Uusi kansio
    2008-05-23 18:11 . 2008-05-27 15:16 54,156 --ah-c--- C:\WINDOWS\QTFont.qfn
    2008-05-23 18:11 . 2008-05-23 18:11 1,409 --a--c--- C:\WINDOWS\QTFont.for
    2008-05-17 10:53 . 2008-05-19 17:02 <KANSIO> d----c--- C:\WINDOWS\system32\Adobe

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-06 13:42 --------- dc----w C:\Documents and Settings\KATTILA\Application Data\LimeWire
    2008-06-04 19:02 --------- dc----w C:\Program Files\Paint.NET
    2008-05-23 11:07 --------- dc----w C:\Program Files\Windows Live Safety Center
    2008-05-20 12:14 --------- dc----w C:\Program Files\Microsoft Silverlight
    2008-05-01 17:42 --------- dc----w C:\Documents and Settings\All Users\Application Data\NPF
    2008-05-01 11:27 --------- dc----w C:\Program Files\Alwil Software
    2008-04-25 18:18 --------- dc-h--w C:\Program Files\InstallShield Installation Information
    2008-03-25 04:51 621,344 -c--a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 -c--a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 -c--a-w C:\WINDOWS\system32\win32k.sys
    1999-06-30 13:06 151,552 -c--a-r C:\WINDOWS\inf\Agfa\Message.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-03-29 22:48 86016]
    "RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 18:44 65536]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe]
    "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="E:\Program Files\Gmail\Gmail Notifier\gnotify.exe" [2005-07-16 00:48 479232]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-03-29 22:48 5898240]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]

    C:\Documents and Settings\All Users\K&#8222;ynnist&#8222;-valikko\Ohjelmat\K&#8222;ynnistys\
    Color Calibration.lnk - C:\Program Files\SEC\MagicTune3.5_Client\GammaTray.exe [2006-12-22 15:36:58 36864]
    Logitech Desktop Messenger.lnk - E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-10 16:21:30 67128]
    Logitech SetPoint.lnk - E:\Program Files\Logitech (p&#8222;ivitys)\SetPoint\SetPoint.exe [2007-02-26 11:21:25 784912]
    MagicTune 3.5.lnk - C:\Program Files\SEC\MagicTune3.5_Client\MagicTuneTray.exe [2006-12-22 15:37:06 45056]
    NaturalColorLoad.lnk - C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe [2006-07-21 16:23:18 155715]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    c:\program files\common files\logitech\bluetooth\LBTWlgn.dll 2007-11-15 11:10 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.ffds"= E:\PROGRA~1\MEDIAP~1\CCCP\COMBIN~1\Filters\FFDShow\ff_vfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "E:\\Program Files\\EA GAMES\\Battlefield 2\\Support\\EasyInfo.exe"=
    "E:\\Program Files\\EA GAMES\\Battlefield 2\\Support\\EReg.exe"=
    "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "E:\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "E:\\Program Files\\EA games\\Battlefield 2\\BF2.exe"=
    "E:\\Program Files\\EA games\\Game Spy\\Aphex.exe"=
    "E:\\Program Files\\mIRC\\mirc.exe"=
    "E:\\Program Files\\EA games\\Medal of Honor\\mohpa.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "E:\\Program Files\\LimeWire\\LimeWire.exe"=
    "E:\\Program Files\\Empire Earth\\Empire Earth.exe"=
    "E:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\Opera\\Opera.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 0 (0x0)

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-06-30 01:53]
    R2 PD91Agent;PD91Agent;"E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe" [2008-01-16 10:52]
    R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\getnd5b.sys [2004-01-29 09:32]
    S3 PD91Engine;PD91Engine;"E:\Program Files\1.6.2008\Uusi kansio\PD91Engine.exe" [2008-01-16 10:52]

    *Newly Created Service* - CATCHME
    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-06-07 06:10:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-07 10:05:32
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-07 10:06:25
    ComboFix-quarantined-files.txt 2008-06-07 07:06:12
    ComboFix2.txt 2008-06-05 17:38:50
    ComboFix3.txt 2008-06-05 16:38:14

    Pre-Run: 4,424,617,984 tavua vapaana
    Post-Run: 4,448,784,384 tavua vapaana

    132 --- E O F --- 2008-05-28 11:32:16
     
    Naamikko, Jun 7, 2008
    #13
  14. Hujo

    Hujo Guest

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
     
    Hujo, Jun 7, 2008
    #14
  15. Naamikko

    Naamikko Member

    Joined:
    Jun 5, 2008
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    ComboFix 08-06-04.5 - KATTILA 2008-06-07 12:18:17.5 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.645 [GMT 3:00]
    Running from: C:\Documents and Settings\KATTILA\Työpöytä\ComboFix.exe
    Command switches used :: C:\Documents and Settings\KATTILA\Työpöytä\CFScript.txt.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\is155400.exe
    C:\setz.exe
    C:\WINDOWS\is154890.exe
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\is155400.exe
    C:\setz.exe
    C:\WINDOWS\is154890.exe

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-07 to 2008-06-07 )))))))))))))))))
    .

    2008-06-07 09:31 . 2008-06-07 09:32 <KANSIO> d----c--- C:\Documents and Settings\Järjestelmänvalvoja
    2008-06-07 09:07 . 2008-06-07 09:07 <KANSIO> d----c--- C:\RegSeeker
    2008-06-06 18:05 . 2008-06-06 18:05 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Avg8
    2008-06-05 21:20 . 2008-06-05 21:20 <KANSIO> d----c--- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-05 21:20 . 2008-06-05 21:20 <KANSIO> d----c--- C:\Documents and Settings\KATTILA\Application Data\Malwarebytes
    2008-06-05 21:20 . 2008-06-05 21:20 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-05 21:20 . 2008-05-30 01:06 34,296 --a--c--- C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-05 21:20 . 2008-05-30 01:06 15,864 --a--c--- C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-02 19:58 . 2008-06-02 22:42 121 --a--c--- C:\WINDOWS\bdagent.INI
    2008-06-02 19:49 . 2008-06-02 22:44 <KANSIO> d----c--- C:\Program Files\BitDefender
    2008-06-02 19:47 . 2008-06-02 19:49 <KANSIO> d----c--- C:\Program Files\Common Files\BitDefender
    2008-06-02 19:16 . 2008-06-02 19:16 <KANSIO> d----c--- C:\Program Files\Java
    2008-06-02 19:16 . 2008-06-02 19:16 <KANSIO> d----c--- C:\Program Files\Common Files\Java
    2008-06-02 19:16 . 2008-03-25 02:37 69,632 --a--c--- C:\WINDOWS\system32\javacpl.cpl
    2008-06-01 22:26 . 2008-06-01 22:26 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Raxco
    2008-06-01 22:26 . 2008-01-09 22:00 68,624 -ra--c--- C:\WINDOWS\system32\drivers\DefragFS.sys
    2008-06-01 22:24 . 2008-06-02 19:20 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-06-01 21:46 . 2008-06-06 23:13 742 --a--c--- C:\delete.bat
    2008-05-30 19:57 . 1998-08-10 22:21 132,096 --a--c--- C:\WINDOWS\system32\eaexec.exe
    2008-05-30 19:57 . 1998-08-10 22:20 24,576 --a--c--- C:\WINDOWS\system32\ealtest.exe
    2008-05-25 17:59 . 2008-05-25 17:59 <KANSIO> d----c--- C:\Program Files\Uusi kansio
    2008-05-23 18:11 . 2008-05-27 15:16 54,156 --ah-c--- C:\WINDOWS\QTFont.qfn
    2008-05-23 18:11 . 2008-05-23 18:11 1,409 --a--c--- C:\WINDOWS\QTFont.for
    2008-05-17 10:53 . 2008-05-19 17:02 <KANSIO> d----c--- C:\WINDOWS\system32\Adobe

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-06 13:42 --------- dc----w C:\Documents and Settings\KATTILA\Application Data\LimeWire
    2008-06-04 19:02 --------- dc----w C:\Program Files\Paint.NET
    2008-05-23 11:07 --------- dc----w C:\Program Files\Windows Live Safety Center
    2008-05-20 12:14 --------- dc----w C:\Program Files\Microsoft Silverlight
    2008-05-01 17:42 --------- dc----w C:\Documents and Settings\All Users\Application Data\NPF
    2008-05-01 11:27 --------- dc----w C:\Program Files\Alwil Software
    2008-04-25 18:18 --------- dc-h--w C:\Program Files\InstallShield Installation Information
    2008-03-25 04:51 621,344 -c--a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 -c--a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 -c--a-w C:\WINDOWS\system32\win32k.sys
    1999-06-30 13:06 151,552 -c--a-r C:\WINDOWS\inf\Agfa\Message.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-03-29 22:48 86016]
    "RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 18:44 65536]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe]
    "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="E:\Program Files\Gmail\Gmail Notifier\gnotify.exe" [2005-07-16 00:48 479232]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-03-29 22:48 5898240]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]

    C:\Documents and Settings\All Users\K&#8222;ynnist&#8222;-valikko\Ohjelmat\K&#8222;ynnistys\
    Color Calibration.lnk - C:\Program Files\SEC\MagicTune3.5_Client\GammaTray.exe [2006-12-22 15:36:58 36864]
    Logitech Desktop Messenger.lnk - E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-10 16:21:30 67128]
    Logitech SetPoint.lnk - E:\Program Files\Logitech (p&#8222;ivitys)\SetPoint\SetPoint.exe [2007-02-26 11:21:25 784912]
    MagicTune 3.5.lnk - C:\Program Files\SEC\MagicTune3.5_Client\MagicTuneTray.exe [2006-12-22 15:37:06 45056]
    NaturalColorLoad.lnk - C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe [2006-07-21 16:23:18 155715]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    c:\program files\common files\logitech\bluetooth\LBTWlgn.dll 2007-11-15 11:10 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.ffds"= E:\PROGRA~1\MEDIAP~1\CCCP\COMBIN~1\Filters\FFDShow\ff_vfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "E:\\Program Files\\EA GAMES\\Battlefield 2\\Support\\EasyInfo.exe"=
    "E:\\Program Files\\EA GAMES\\Battlefield 2\\Support\\EReg.exe"=
    "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "E:\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "E:\\Program Files\\EA games\\Battlefield 2\\BF2.exe"=
    "E:\\Program Files\\EA games\\Game Spy\\Aphex.exe"=
    "E:\\Program Files\\mIRC\\mirc.exe"=
    "E:\\Program Files\\EA games\\Medal of Honor\\mohpa.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "E:\\Program Files\\LimeWire\\LimeWire.exe"=
    "E:\\Program Files\\Empire Earth\\Empire Earth.exe"=
    "E:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\Opera\\Opera.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 0 (0x0)

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-06-30 01:53]
    R2 PD91Agent;PD91Agent;"E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe" [2008-01-16 10:52]
    R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\getnd5b.sys [2004-01-29 09:32]
    S3 PD91Engine;PD91Engine;"E:\Program Files\1.6.2008\Uusi kansio\PD91Engine.exe" [2008-01-16 10:52]

    *Newly Created Service* - CATCHME
    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-06-07 09:10:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-07 12:19:07
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-07 12:19:43
    ComboFix-quarantined-files.txt 2008-06-07 09:19:41
    ComboFix2.txt 2008-06-07 07:06:27
    ComboFix3.txt 2008-06-05 17:38:50
    ComboFix4.txt 2008-06-05 16:38:14

    Pre-Run: 4,349,403,136 tavua vapaana
    Post-Run: 4,379,750,400 tavua vapaana

    142 --- E O F --- 2008-05-28 11:32:16
     
    Naamikko, Jun 7, 2008
    #15
  16. Hujo

    Hujo Guest

    scannaa vielä Malwarebytes' Anti-Malwarella.

     
    Hujo, Jun 7, 2008
    #16
  17. Naamikko

    Naamikko Member

    Joined:
    Jun 5, 2008
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Malwarebytes' Anti-Malware 1.14
    Tietokantaversio: 829

    14:02:49 7.6.2008
    mbam-log-6-7-2008 (14-02-49).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|E:\|F:\|)
    Tarkistetut kohteet: 206481
    Kulunut aika: 1 hour(s), 5 minute(s), 25 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 22

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP780\A0123774.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP783\A0124093.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP783\A0124094.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP783\A0124096.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP784\A0124108.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP784\A0124109.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP784\A0124172.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP784\A0124178.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP784\A0124179.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP784\A0124184.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP784\A0124206.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP785\A0124273.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP785\A0124721.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP785\A0124737.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP785\A0124744.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP785\A0124770.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP786\A0124823.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP786\A0125791.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP787\A0125854.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP788\A0125971.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP789\A0126030.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{5FE20E88-3C08-4330-AF38-6186C8E1E901}\RP789\A0126032.com (Backdoor.Bot) -> Quarantined and deleted successfully.
     
    Naamikko, Jun 7, 2008
    #17
  18. Hujo

    Hujo Guest

    1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
    2. Valitse ominaisuudet
    3. Valitse järjestelmän palauttaminen välilehti
    4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
    5. Paina Käytä
    6. Paina ok
    7. Sammuta ja käynnistä
    8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
    9. Käytä ja OK

    ============

    scannaa uusi hjt:n loki ja combofix loki
     
    Hujo, Jun 7, 2008
    #18
  19. Naamikko

    Naamikko Member

    Joined:
    Jun 5, 2008
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of HijackThis v1.99.1
    Scan saved at 16:14:00, on 7.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\system32\nvsvc32.exe
    E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\Explorer.EXE
    E:\Program Files\Gmail\Gmail Notifier\gnotify.exe
    C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SEC\MagicTune3.5_Client\GammaTray.exe
    E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    E:\Program Files\Logitech (päivitys)\SetPoint\SetPoint.exe
    C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\KATTILA\Työpöytä\HijackThis_v1.99.1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\1610D9~1.200\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] E:\Program Files\Gmail\Gmail Notifier\gnotify.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Color Calibration.lnk = ?
    O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = ?
    O4 - Global Startup: MagicTune 3.5.lnk = ?
    O4 - Global Startup: NaturalColorLoad.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\1610D9~1.200\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\1610D9~1.200\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PD91Agent - Raxco Software, Inc. - E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe
    O23 - Service: PD91Engine - Raxco Software, Inc. - E:\Program Files\1.6.2008\Uusi kansio\PD91Engine.exe






    ComboFix 08-06-04.5 - KATTILA 2008-06-07 16:14:36.6 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.654 [GMT 3:00]
    Running from: C:\Documents and Settings\KATTILA\Työpöytä\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-07 to 2008-06-07 )))))))))))))))))
    .

    2008-06-07 09:31 . 2008-06-07 09:32 <KANSIO> d----c--- C:\Documents and Settings\Järjestelmänvalvoja
    2008-06-07 09:07 . 2008-06-07 09:07 <KANSIO> d----c--- C:\RegSeeker
    2008-06-06 18:05 . 2008-06-06 18:05 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Avg8
    2008-06-05 21:20 . 2008-06-05 21:20 <KANSIO> d----c--- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-05 21:20 . 2008-06-05 21:20 <KANSIO> d----c--- C:\Documents and Settings\KATTILA\Application Data\Malwarebytes
    2008-06-05 21:20 . 2008-06-05 21:20 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-05 21:20 . 2008-05-30 01:06 34,296 --a--c--- C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-05 21:20 . 2008-05-30 01:06 15,864 --a--c--- C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-02 19:58 . 2008-06-02 22:42 121 --a--c--- C:\WINDOWS\bdagent.INI
    2008-06-02 19:49 . 2008-06-02 22:44 <KANSIO> d----c--- C:\Program Files\BitDefender
    2008-06-02 19:47 . 2008-06-02 19:49 <KANSIO> d----c--- C:\Program Files\Common Files\BitDefender
    2008-06-02 19:16 . 2008-06-02 19:16 <KANSIO> d----c--- C:\Program Files\Java
    2008-06-02 19:16 . 2008-06-02 19:16 <KANSIO> d----c--- C:\Program Files\Common Files\Java
    2008-06-02 19:16 . 2008-03-25 02:37 69,632 --a--c--- C:\WINDOWS\system32\javacpl.cpl
    2008-06-01 22:26 . 2008-06-01 22:26 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Raxco
    2008-06-01 22:26 . 2008-01-09 22:00 68,624 -ra--c--- C:\WINDOWS\system32\drivers\DefragFS.sys
    2008-06-01 22:24 . 2008-06-02 19:20 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-06-01 21:46 . 2008-06-06 23:13 742 --a--c--- C:\delete.bat
    2008-05-30 19:57 . 1998-08-10 22:21 132,096 --a--c--- C:\WINDOWS\system32\eaexec.exe
    2008-05-30 19:57 . 1998-08-10 22:20 24,576 --a--c--- C:\WINDOWS\system32\ealtest.exe
    2008-05-25 17:59 . 2008-05-25 17:59 <KANSIO> d----c--- C:\Program Files\Uusi kansio
    2008-05-23 18:11 . 2008-05-27 15:16 54,156 --ah-c--- C:\WINDOWS\QTFont.qfn
    2008-05-23 18:11 . 2008-05-23 18:11 1,409 --a--c--- C:\WINDOWS\QTFont.for
    2008-05-17 10:53 . 2008-05-19 17:02 <KANSIO> d----c--- C:\WINDOWS\system32\Adobe

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-07 10:06 --------- dc----w C:\Documents and Settings\KATTILA\Application Data\LimeWire
    2008-06-04 19:02 --------- dc----w C:\Program Files\Paint.NET
    2008-05-23 11:07 --------- dc----w C:\Program Files\Windows Live Safety Center
    2008-05-20 12:14 --------- dc----w C:\Program Files\Microsoft Silverlight
    2008-05-01 17:42 --------- dc----w C:\Documents and Settings\All Users\Application Data\NPF
    2008-05-01 11:27 --------- dc----w C:\Program Files\Alwil Software
    2008-04-25 18:18 --------- dc-h--w C:\Program Files\InstallShield Installation Information
    2008-03-25 04:51 621,344 -c--a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 -c--a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 -c--a-w C:\WINDOWS\system32\win32k.sys
    1999-06-30 13:06 151,552 -c--a-r C:\WINDOWS\inf\Agfa\Message.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-06-07_10.06.03,90 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-07 07:00:39 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-07 13:11:05 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-07 13:11:11 16,384 -c--atw C:\WINDOWS\Temp\Perflib_Perfdata_690.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-03-29 22:48 86016]
    "RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 18:44 65536]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe]
    "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="E:\Program Files\Gmail\Gmail Notifier\gnotify.exe" [2005-07-16 00:48 479232]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-03-29 22:48 5898240]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]

    C:\Documents and Settings\All Users\K&#8222;ynnist&#8222;-valikko\Ohjelmat\K&#8222;ynnistys\
    Color Calibration.lnk - C:\Program Files\SEC\MagicTune3.5_Client\GammaTray.exe [2006-12-22 15:36:58 36864]
    Logitech Desktop Messenger.lnk - E:\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-10 16:21:30 67128]
    Logitech SetPoint.lnk - E:\Program Files\Logitech (p&#8222;ivitys)\SetPoint\SetPoint.exe [2007-02-26 11:21:25 784912]
    MagicTune 3.5.lnk - C:\Program Files\SEC\MagicTune3.5_Client\MagicTuneTray.exe [2006-12-22 15:37:06 45056]
    NaturalColorLoad.lnk - C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe [2006-07-21 16:23:18 155715]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    c:\program files\common files\logitech\bluetooth\LBTWlgn.dll 2007-11-15 11:10 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.ffds"= E:\PROGRA~1\MEDIAP~1\CCCP\COMBIN~1\Filters\FFDShow\ff_vfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "E:\\Program Files\\EA GAMES\\Battlefield 2\\Support\\EasyInfo.exe"=
    "E:\\Program Files\\EA GAMES\\Battlefield 2\\Support\\EReg.exe"=
    "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "E:\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "E:\\Program Files\\EA games\\Battlefield 2\\BF2.exe"=
    "E:\\Program Files\\EA games\\Game Spy\\Aphex.exe"=
    "E:\\Program Files\\mIRC\\mirc.exe"=
    "E:\\Program Files\\EA games\\Medal of Honor\\mohpa.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "E:\\Program Files\\LimeWire\\LimeWire.exe"=
    "E:\\Program Files\\Empire Earth\\Empire Earth.exe"=
    "E:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\Opera\\Opera.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 0 (0x0)

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-06-30 01:53]
    R2 PD91Agent;PD91Agent;"E:\Program Files\1.6.2008\Uusi kansio\PD91Agent.exe" [2008-01-16 10:52]
    R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\getnd5b.sys [2004-01-29 09:32]
    S3 PD91Engine;PD91Engine;"E:\Program Files\1.6.2008\Uusi kansio\PD91Engine.exe" [2008-01-16 10:52]

    *Newly Created Service* - CATCHME
    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-06-07 12:10:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-07 16:16:03
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-07 16:16:56
    ComboFix-quarantined-files.txt 2008-06-07 13:16:46
    ComboFix2.txt 2008-06-07 09:19:44
    ComboFix3.txt 2008-06-07 07:06:27
    ComboFix4.txt 2008-06-05 17:38:50
    ComboFix5.txt 2008-06-05 16:38:14

    Pre-Run: 5,499,850,752 tavua vapaana
    Post-Run: 5,490,810,880 tavua vapaana

    137 --- E O F --- 2008-05-28 11:32:16
     
    Naamikko, Jun 7, 2008
    #19
  20. Hujo

    Hujo Guest

    aurinkoista iltapäivän jatkoo. :)
     
    Last edited by a moderator: Jun 7, 2008
    Hujo, Jun 7, 2008
    #20
Page 1 of 2

Share This Page